When session expires

NZ_Kiwis

I want my page to redirect me once my session has expired if a page is not reloaded or the user is still no longer browsing pages.

How can I do this?

I thought about running an ajax script that checks to see if a $_SESSION['UserID'] exists, this does not seem to work.

I thought about having a count down timer using JS script which after a select time frame redirected a user however most of the content for my page is on my index.php page and is loaded via Ajax scripts so it's not reloaded very often. this meaning the countdown timer will run out before my SESSION does (each page which is loaded restarts the SESSION time)

Ashley_Sheridan

What did you try with your Ajax script, as that would work for what you want here.

NZ_Kiwis

this is my js and I do get the alert as its run in a loop with a timer

function CheckSession(){
if (window.XMLHttpRequest) {// code for IE7+, Firefox, Chrome, Opera, Safari
		xmlhttp=new XMLHttpRequest();
	} else {// code for IE6, IE5
		xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
	}
	xmlhttp.onreadystatechange=function(){
		if(
			xmlhttp.readyState==4 && xmlhttp.status==200)
				{
					 alert('sessoin checked');
				}
			}

xmlhttp.open("GET","ajax/check-session.php",true);
xmlhttp.send();	
}

check session.php page

<?php
session_start();

header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past

if (!isset($_COOKIE['mycookie'])){
	header("LOCATION: ../index.php?l=4");
	exit();

}
?>

Ashley_Sheridan

You mention checking the session, but your code is checking cookies (which can be used in sessions, but aren't necessarily session cookies). Also, Javascript can read the cookies directly without the need to refer to PHP.

There are several other issues with this: you're setting an expires header on the returned content of an ajax call, which is not the same as setting an expiration on a session, and you're then trying to perform a redirect on the whole page, but as this is part of an ajax call it won't ever redirect the page.

Lastly, if you repeatedly call this script with an Ajax call, the session won't ever die, because the calls are keeping it alive. Better to maybe just let it die naturally and then when the user tries to perform an action they will be dealt with as normal.

NZ_Kiwis

Ashley Sheridan;11018389 wrote:
You mention checking the session, but your code is checking cookies (which can be used in sessions, but aren't necessarily session cookies). Also, Javascript can read the cookies directly without the need to refer to PHP..

Sorry, I am checking for a cookie, my error.

Ashley Sheridan;11018389 wrote:
There are several other issues with this: you're setting an expires header on the returned content of an ajax call, which is not the same as setting an expiration on a session, and you're then trying to perform a redirect on the whole page, but as this is part of an ajax call it won't ever redirect the page.

I'm doing that with the header to prevent caching on IE - with Ajax I find a number of issues with this and ajax. That should not effect it's performance should it?

Ashley Sheridan;11018389 wrote:
Lastly, if you repeatedly call this script with an Ajax call, the session won't ever die, because the calls are keeping it alive. Better to maybe just let it die naturally and then when the user tries to perform an action they will be dealt with as normal.

That is one option but I don't want other ajax scripts's to keep running and doing things IF the cookie has expired so when it expires I want the user redirected to another page to prevent that from happening.

johanafm

Could those ajax scripts not simply check if the cookie has expired or not before actually doing anything?

Or perhaps make the ajax callers redirect if they try to talk to the server after the session expired, i.e. the call gets to the server without any pre-checks, but once there the server realizes the user is no longer logged in, replies with a value to indicate redirection to login page is needed and the ajax success handler redirects using window.location.

NZ_Kiwis

that's what I have, obviously I've replaced the alert with a windows.redirect but this does not seem to work.

Is there another way of doing this all together?

johanafm

If all you want to do is check a cookie, you are better off doing so in the browser. While cookies are stored as a property of document, namely document.cookie, they are in point of fact not local to document, or even to tab/window for that matter. They are - session local storage.

Thus, if you set a cookie which expires after 10 seconds in tab 1, and wait 10+ seconds before checking the cookie, you'll find no such cookie (it expired). However, if you now load tab2 which once again sets the same cookie name with a 10 second duration and go back to check the cookie in tab 1 - it will be there for 10 seconds.

And that's the way you can implement Session Storage on browsers that doens't support it, just like you can use window.name to implement Local Storage.

Not sure why an extra space made its way into the cookie name, but rather than finding out why, I used trim(). And since trim() doesn't exist in IE8, I added it to String.prototype if needed. The rest is straightforward cookie handling.

<?php
header('content-type: text/html; charset=utf-8');
setcookie('check', 'whatever', time() + 10);
?>
<!DOCTYPE html>
<html>
<head>
<title>Cookie Checker-o 4000!</title>

<script>
if (String.prototype.trim == undefined) {
	String.prototype.trim = function() {
		return this.replace(/^\s+|\s+$/g,"");
	}
}

function cookietimer(cname) {
	var carr = document.cookie.split(';');

var found = false;
for (var i = carr.length - 1; i < carr.length; ++i) {
	var pair = carr[i].split('=');
	pair[0] = pair[0].trim();
	cname = cname.trim();
	if (pair[0].localeCompare(cname) == 0) {
		found = true;
		break;
	}
}
if (found)
{
	alert(pair[0] + ': ' + pair[1]);
}
else {
	alert('no such cookie');
}
}

</script>

</head>
<body>
<div>
	<input type="button" onclick="cookietimer('check');" value="Cookie Timer Check">
</div>
</body>
</html>

Edit: The point of the code is to show what I described above. Open a tab and request the above page. Click button. Wait 10 seconds, click button: "no such cookie". Open a second tab, request above page. Go to first tab, click button again. Wait 10 seconds...